Security
NexloLabs Cloud is designed around a simple principle: your data should be encrypted before it ever reaches a server you don't control.
Client-side encryption
Files are encrypted on your device before they are uploaded. Only ciphertext is transmitted and stored on our servers.
Encrypted file and folder names
File and folder names are encrypted client-side with the same master key. The backend only sees opaque ciphertext.
Zero-knowledge key design
Your master encryption key is derived from your password on your device and never sent to us. We store only key-wrapping blobs that we cannot open.
AES-256-GCM + HKDF + PBKDF2
We use well-audited standard primitives: AES-256-GCM for encryption, HKDF-SHA256 for per-chunk keys and PBKDF2-SHA256 (600,000 iterations) for key derivation. We never invent our own cryptography.
Secure transport
All data is transmitted over HTTPS/TLS.
Password protection
Passwords are securely hashed using Argon2id before storage. They are never stored or logged in plaintext.
Minimal access
The backend has no access to plaintext user files. Without your password (or recovery key) the stored data cannot be decrypted.
Security transparency
We document our security architecture and assumptions, and we will keep improving it. No system is infallible — we do not claim to be unhackable.
What we don't claim
- No system is unhackable — we make no such claims.
- Client-side encryption protects data at rest from the service provider, but it cannot protect against malware on your own device.
- If you lose your password and your recovery key, your files cannot be recovered by anyone — including us.
Historical integrity: metadata such as file size, number of chunks and upload time are visible to the service (they are required to serve the data back to you). See Privacy for details.